Password strength checker: how long would yours lastAn estimate of how a smart guesser would attack your password, worked out in your browser and never sent anywhere.

Many strength meters reward a capital and a symbol and stop there. This one thinks like guessing software, which tries the patterns people use most before it falls back to brute force.

Using the check

Type into the box above, up to 128 characters. The estimate updates with every key, and the Show button reveals what you typed. A close variation of a password works as well as the real thing, because the patterns are what count.

You get a label from Very weak to Very strong, the estimated number of guesses (as a power of ten and in bits), the average time to guess it at four attack speeds, the patterns it found, and warnings and tips on what to change.

How the estimate is worked out

The tool splits the password into the pieces guessing software tries first and prices each in guesses:

• Common passwords, from a list of 110 that top public breach lists. A hit costs roughly its rank on the list.
• Everyday words and first names, about 165 of them. A hit costs 400 to 570 guesses.
• Keyboard runs such as qwerty or 1qaz, sequences such as abc or 4321, and repeats such as aaa or abcabc.
• Years from 1900 to 2049 (150 guesses) and six or eight digit strings that read as dates (about 146,000 guesses: 365 days, 100 years, four common formats).

A capital first letter doubles the cost of a word, capitals in other places multiply it by four times the word's length, and swapping letters for look-alikes (0 for o, @ for a, 3 for e) multiplies it by four. Each piece also doubles the total, because a guesser has to try the ways pieces are joined. Each leftover character multiplies the total by the size of the character set in use: 26 for lower case, 26 for capitals, 10 for digits, 33 for symbols and the space, 100 for anything beyond basic keyboard characters. The tool keeps whichever split needs the fewest guesses, as a good attacker would.

The labels use the same orders of magnitude as zxcvbn, the open-source estimator Dropbox published:

The time table assumes the attacker finds the password halfway through the search, on average, at these speeds:

Anything over a hundred years shows as "centuries".

A worked example: Summer2024#

Take the obviously made-up Summer2024#. The tool finds two patterns and one leftover character:

1. "Summer" is on the common password list, 69th of 110, which prices it at about 70 guesses. The capital S doubles that to 140, and being one of the pieces doubles it again to 280.
2. "2024" is a year: 150 possibilities, doubled to 300.
3. "#" is left over. The password mixes lower case, a capital, digits and a symbol, so that one character could be any of 95.

Multiply them: 280 times 300 times 95 is about 8 million guesses, or 10 to the power 6.9, roughly 23 bits. That lands in Fair. On average it would hold out for about 5 years against a site that limits attempts, 5 days against one that does not, 7 minutes against a stolen file with a slow hash, and less than a second against a fast hash. The warnings name the common password and the year, and the tips say to make it longer and let a password manager create one for you.

Delete the "#" and the score drops to Weak, about 84,000 guesses. That one symbol is doing most of the work.

What it cannot tell you

• The lists are short. A password built on a word that is not among the 110 common passwords or 165 words and names is treated as random letters. Something like Mapleleaf2024# shows as Very strong here, even though any real cracking dictionary holds both words. Read a high score on a word-based password with that in mind.
• A symbol on the end is counted as random. Real guessing tools try the usual symbols on the end early, so the example above is a little kinder than reality.
• It does not know whether the password has already leaked. A password from a breach list is weak whatever its score. If one of yours was in a breach notice, the breach checklist puts the steps in order.
• It cannot see reuse or storage. A Very strong password used on five sites is only as safe as the weakest of them, and the four speeds are reference points, not a forecast for any one service.

Privacy

The check runs entirely in your browser. Nothing you type is sent, logged or saved, not even in your browser's local storage, and it is gone when you close the tab.

Questions

Why does another site score the same password differently?

Every meter has its own word lists and its own idea of attack speed. Some only count character types, so they like Summer2024#. Ours prices patterns first, which gives lower scores to passwords built from words and dates.

What do the bits mean?

Bits are another way to write the number of guesses: every extra bit doubles it. The 23 bits in the example mean about 8 million guesses. Ten more bits multiply that by roughly a thousand.

Do I need symbols and capitals?

Length matters more. NIST's guidance, SP 800-63B, tells services not to force mixtures of character types and sets 15 characters as the minimum for a password used on its own. A run of random words, like the ones from our passphrase generator, gets long without being hard to type.

Is it safe to type my real password here?

Nothing leaves the page, so the check does not expose it. We still suggest a close variation as a habit: typing real passwords into web pages is how phishing works.

My password scored Very strong. Am I done?

Not quite. Use it on one account only, and turn on two-step sign-in where it matters, starting with your email. Our guide to password managers, passkeys and two-step codes covers how to set that up in one evening.